Efficient Drive forensics – and it’s free! Active@ Disk Editor Efficient Drive forensics – and it’s free! Prepared by Edward Webber

Reasons to use it: Where to find it http://www.disk-editor.org/download Reasons to use it: Completely free Regular updates Has partner file recovery app Eliminates data location calculation errors Reduces time to find data Automatically translates data for multiple file systems into user-readable format

Main features More than a basic hex editor

features overview Drive Support Template Driven Data Displays Hard disk drives SSD & USB Disks Partitions & Volumes Files Template Driven Data Displays Drive Images Support vmWare dd images MS Virtual PC DIM support (disk image + metadata) Hyperlinks For example: MFT records link to first cluster in data run MBR links to partitions. Built-in File Editor All features are self-contained No plug-ins needed

Alternative: Hex workshop Drawbacks: $90 per seat No updates in two years Lacks modern interface Steep learning curve No block hyperlinking No file system templates Manual sector calculations Must rely on bookmarks Wall of hex

Disk editor vs. Hex workshop Feature DE HW Maximum file size Partial file loading Disk sector editing Bit editing Text editor Insert / Delete bytes Bit Shifting Search Unicode N/A YES NO NO* Feature DE HW File structure view Hi-res Support File Compare Find in Files Bookmarks Macro Data inspector Auto-Highlighting YES NO NO*

Which would you choose? Color coded. Modern interface. Wall of Hex. UI from the 80’s.

Find the Total Sectors: Disk Editor 6 Find the Total Sectors: Where is it located? What’s the value? (8 bit? 16 bit? Signed?) MFT cluster number? Hyperlinked

Find the Total Sectors: Hex workshop 6.8 Find the Total Sectors: Where is it located? What’s the value? (8 bit? 16 bit? Signed?) MFT cluster number?

Forensics problem 1 Sampling the power of disk editor

Forensics problem 1 3/30/2016 4:59 PM Open Active@ Disk Editor 3/30/2016 4:59 PM Select “open disk image” 3/30/2016 5:00 PM Select “All files” from the extension dropdown menu and open FP1.dd

Forensics problem 1 3/30/2016 5:01 PM Click the “Find” icon, enter “pw” in the search field 3/30/2016 5:02 PM If not selected, select the “Find Results” tab in the lower left.

Forensics problem 1 3/30/2016 7:28 PM Select “‘pw’ Down; Match case (1 hits)”, then select “pw=goodtimes” 3/30/2016 7:31 PM Password is hidden within the RAM slack of “Cover page.jpg” image file. Should appear as “pw=goodtimes” in sector x2156 (8,534) at offset x40-4B (64-76)

Project 5.2 – file entry metadata Where disk editor shines (and hex workshop nightmares begin)

specific files C5Prj02.txt Contents: “A slip of the foot you may soon recover, but a slip of the tongue you may never get over. Drive thy buisness or it will drive thee. An investment in knowledge always pays the best interest.”

Organized metadata structure File metadata Fully highlighted Organized metadata structure Attribute sections 10 30 80

File metadata – mac times No guessing No math No losing your place in a sea of hex No human error At-a-glance results

File previews Many formats supports Word RTF Excel CSV Text JPG BMP TIFF PNG

FAT32/USB File System Evaluation Where disk editor shines (and hex workshop nightmares continue)

FAT32/USB File System Evaluation Switch between Hex / Dec? One mouse click FAT32 Boot Sector Automatically highlighted and parsed

FAT32/USB File System Evaluation Root directory entry Where is it? Do the math: Sectors per FAT: 1,955 Number of FATs: 2 1955 x 2 = 3,910 Reserved sectors: 4,282 4,282 + 3,910 = 8,192 Bytes per sector: 512 Sectors per cluster: 8 Root cluster: 2 512 x 8 x 2 = 8,192

FAT32/USB File System Evaluation FAT32 Boot Sector Boot sector validator Checks for out of spec values

Did I mention FREE? Summary Active@ Disk Editor 6 Quick shortcuts to content Clickable hyperlinks to relevant sectors FREE! Easy file editing Easy to learn Minimal training required Did I mention FREE? Prevents hex reading mistakes Little endian, Big endian – All automatically calculated

Active@ Disk Editor Questions? http://www.disk-editor.org/download Presentation by: Edward webber